D-19 · ARCHITECTURE · SUBDOMAINS
Subdomain segmentation strategy
Subdomains are reputation bulkheads. This scenario assigns transactional, marketing, and lifecycle streams to identities that fail independently.
Symptom
Everything sends from the apex domain: receipts, newsletters, onboarding drips, investor updates, and employee forwards. A newsletter complaint spike then degrades password-reset placement; a rebrand’s new marketing vendor misconfigures DKIM and transactional fails DMARC; nobody can answer “which stream caused this” because telemetry shares one identity. Each incident requires freezing all mail to fix one stream’s problem.
DMARC policy becomes impossible: strict reject breaks third-party flows sharing the apex, while lax none leaves phishing unblocked everywhere.
Cause
Reputation, authentication, and policy all scope to domains. Sharing one domain across heterogeneous streams couples their fates: engagement, complaint, and bounce histories blend into a single score, DKIM selectors and return-paths collide across vendors, and per-stream throttling cannot isolate. Organizational convenience (“one domain, one setup”) trades setup simplicity for incident blast radius.
Vendor defaults encourage the coupling: unless teams deliberately configure per-stream subdomains with aligned return-paths, platforms happily share whatever domain was first verified.
Fix
Assign at minimum three sending subdomains: transactional (receipts, auth, alerts — plain templates, highest protection), marketing (newsletters, promotions — full branding, aggressive sunset policies), and lifecycle (onboarding, dunning, win-back — product-triggered, billing-aware). Larger programs add a fourth for editorial or partner content. Each gets independent SPF, DKIM selectors, return-path, DMARC monitoring, and Postmaster tracking.
Migrate one stream at a time during quiet weeks, warming each subdomain with its own engaged traffic before full cutover. Keep corporate correspondence on the apex untouched by bulk infrastructure.
Prevention
Require every new template and vendor to declare its subdomain at creation; reject apex-sending requests by default with a documented exception process. Review per-subdomain reputation dashboards weekly, enforce stream-specific content standards (transactional minimalism vs marketing branding), and audit DNS inventories quarterly for selector sprawl and stale vendor includes. Subdomain discipline compounds: each incident stays contained, each stream’s history stays legible.
Worked example
A SaaS company sends everything from its apex: receipts, newsletters, drips, and staff forwards. After a newsletter complaint spike delays 2FA codes company-wide, the team creates three subdomains — transactional, marketing, lifecycle — each with dedicated DKIM selectors, return-paths, and Postmaster tracking. Transactional migrates first during a quiet week, marketing follows with re-warmed engaged cohorts, lifecycle last with billing-triggered flows.
Six months later a partner-content blast underperforms and gets bulk-foldered — but only on the marketing subdomain. Transactional and lifecycle placement never move, support sees no auth-code tickets, and the incident review takes an hour instead of a week. The apex, freed from bulk entirely, finally qualifies for strict DMARC reject, cutting phishing abuse against the brand. Bulkheads hold exactly as designed.